Re: [Dime] Question on realm validity in answer messages

[Jouni Korhonen <[e-mail]>]

Your load balancer is misbehaving. Unfortunately you don't find any 
exact specification language to prohibit the proxy vendor doing this.

- Jouni



5/8/2014 8:44 AM, Marco Stura kirjoitti:
> Dear all,
>
> I’m facing the following situation.
>
> |----------------------------
> SPrealm--------------------------------------------------|
>
>                                                                                     _----------- Server 1(realm a)
>
>
>                                   _
>
>                                                                               _
>
> Client ------------------ Proxy(SPrealm) ---------------- Server 2(realm b)
>
>                                                                              _
>
>
>                                                        _
>
>                                                                                     _
>
>                                                                                         ---------- Sever 3 (realm c)
>
> The implementation is such that the Proxy is load balancing by selecting
> the internal Server where the subscriber data are provisioned, based on
> user identity.
>
> The Client is sending an application specific authorization request to
> the Proxy for NAI user@SPrealm, Destination-Realm == SPrealm.
>
> The Proxy selects e.g. Server 2 based on user@SPrealm and send the
> request there changing the Destination-Realm to realm b.
>
> Server 2 processes the request generates an answer and send it to the
> Proxy with Origin-Host == server2@realm b, Origin-Realm == realm b.
>
> The Proxy forward the answer to the Client, that receives a successful
> authorization answer from a realm that is different from the one
> supposed to serve the user (as in the NAI).
>
> The client terminates the session with STR to Destination-Host ==
> server2@realm b, Destination-Realm == realm b, Termination-Cause ==
> Diameter_bad_answer
>
> The Proxy and the Servers are part of the same implementation, which
> apparently requires this kind of configuration to work.
>
> In RFC 6733 (or RFC 3388) it is not explicitly stated how to deal with
> cases where a successful authorization answer is coming from a server
> located in a different realm than the home realm of the user (as per NAI).
>
> However, to say the least, this configuration is quite bizarre and the
> client IMHO is right to terminate the session as this behavior may looks
> to the client like an answer from a malicious node. But I don’t remember
> any discussion on this aspects back at the Diameter protocol development
> time…..
>
> Any opinion on this scenario?
>
> BR,
>
> Marco
>
>
> ------------------------------------------------------------------------
>
> The information in this email and any attachments thereto may contain
> information that is confidential, protected by intellectual property
> rights, and may be legally privileged. It is intended solely for the
> addressee(s). Access to this email by anyone else is unauthorized. Any
> use, disclosure, copying, or distribution of the information contained
> herein by persons other than the designated addressee is unauthorized
> and may be unlawful. If you are not the intended recipient, you should
> delete the message immediately from your system. If you believe that you
> have received this email in error, please contact the sender. Any views
> expressed in this email and its attachments are those of the individual
> sender except where the sender expressly states them to be the views of
> Ooredoo.
>
>
> _______________________________________________
> DiME mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dime
>